CVE-2020-24507: Improper initialization in a subsystem in the Intel(R) CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32, 13.50.11…

PriorityP417medium4.4CVSS 3.1

AVLACLPRHUINSUCHINAN

EPSS

0.28%

20.6th percentile

Improper initialization in a subsystem in the Intel(R) CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32, 13.50.11 and 15.0.22 may allow a privileged user to potentially enable information disclosure via local access.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
intel	converged_security_and_manageability_engine	< 12.0.81	12.0.81
intel	converged_security_and_manageability_engine	< 13.0.47	13.0.47
intel	converged_security_and_manageability_engine	< 13.30.17	13.30.17
intel	converged_security_and_manageability_engine	< 14.1.53	14.1.53
intel	converged_security_and_manageability_engine	< 14.5.32	14.5.32
intel	converged_security_and_manageability_engine	< 11.8.86	11.8.86
intel	converged_security_and_manageability_engine	< 11.12.86	11.12.86
intel	converged_security_and_manageability_engine	< 11.22.86	11.22.86
intel	converged_security_and_manageability_engine	< 13.50.11	13.50.11
intel	converged_security_and_manageability_engine	< 15.0.22	15.0.22
siemens	simatic_ipc627e_firmware	< 25.02.10	25.02.10
siemens	simatic_ipc647e_firmware	< 25.02.10	25.02.10
siemens	simatic_ipc677e_firmware	< 25.02.10	25.02.10
siemens	simatic_ipc847e_firmware	< 25.02.10	25.02.10

CVSS provenance

nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.